Privacy Policy

This policy explains how [[RELLENAR: razón social o nombre completo del autónomo]] ([[RELLENAR: NIF/CIF / NIF-IVA]]), [[RELLENAR: dirección postal completa]], handles personal data in Closeout. Contact us at [[RELLENAR: privacidad@tudominio.com]] about anything in it.

1. Our two roles

• Controller for account and billing data of the firms that subscribe (their owners and testers) and for visitors of this website.
• Processor for the data firms upload about their engagements: their clients' contacts, findings, and evidence. The firm is the controller of that data; ask them about it first. We process it only on their instructions.

2. What we collect and why

• Account data (name, email, password hash, two-factor settings): to provide and secure your account. Legal basis: contract.
• Security logs (IP address, sign-ins, actions in the audit log): to protect accounts and investigate abuse. Legal basis: legitimate interest in security.
• Billing data (company name, address, tax id, subscription status): to charge and invoice. Card details are collected by Stripe and never reach our servers. Legal basis: contract and legal obligation.
• Service emails (invitations, fix notifications, security alerts): part of the Service; we don't send marketing without consent.

We do not sell personal data or use it for advertising, and the Service sets no tracking or advertising cookies, only a session cookie needed to stay signed in.

3. Sub-processors

• Hosting and database: [[RELLENAR: proveedor de hosting y región, p. ej. Hetzner (Alemania, UE)]]
• Payments: Stripe (Stripe Payments Europe Ltd., Ireland)
• Transactional email: [[RELLENAR: proveedor de email, p. ej. Postmark (EE. UU.) con SCCs]]

Transfers outside the EEA rely on adequacy decisions or the European Commission's Standard Contractual Clauses.

4. Security

Stored requests and evidence are encrypted with per-engagement keys, tenant data is isolated at the database level, and staff accounts require two-factor authentication. See our security overview for details, and report vulnerabilities to [[RELLENAR: security@tudominio.com]].

5. Retention

• Account and engagement data: while the subscription is active, and up to 30 days after it ends, then deleted.
• Security and audit logs: up to 12 months.
• Invoices and billing records: as long as tax law requires.

6. Your rights

You can request access, correction, deletion, restriction, portability, or object to processing by writing to [[RELLENAR: privacidad@tudominio.com]]. We answer within one month. You can also complain to your data protection authority (in Spain, the AEPD: aepd.es).

7. Changes

We will notify account owners by email of material changes before they apply.